Usability engineering for code-based multi-factor authentication

The increase in the use of online banking and other alternative banking channels has led to improved flexibility for customers but also an increase in the amount of fraud across these channels. The industry recommendation for banks and other financial institutions is to use multi-factor customer authentication to reduce the risk of identity theft and fraud for those choosing to use such banking channels. There are few multi-factor authentication solutions available for banks to use that offer a convenient security procedure across all banking channels. The CodeSure card presented in this research is such a device offering a convenient, multi-channel, two-factor code-based security solution based on the ubiquitous Chip-and-PIN bank card. In order for the CodeSure card to find acceptance as a usable security solution, it must be shown to be easy to use and it must also be easy for customers to understand what they are being asked to do, and how they can achieve it. This need for a usability study forms the basis of the research reported here. The CodeSure card is also shown to play a role in combating identity theft. With the growing popularity of online channels, this research also looks at the threat of phishing and malware, and awareness of users about these threats. Many banks have ceased the use of email as a means to communicate with their customers as a result of the phishing threat, and an investigation into using the CodeSure card's reverse (sender) authentication mode is explored as a potential solution in regaining trust in the email channel and reintroducing it as a means for the bank to communicate with its customers. In the 8 experiments presented in this study the CodeSure card was rated acceptably high in terms of mean usability. Overall, the research reported here is offered in support of the thesis that a usable security solution predicated on code-based multi-factor authentication will result in tangible improvements to actual security levels in banking and eCommerce services, and that the CodeSure card as described here can form the basis of such a usable security solution

Towards secure web browsing on mobile devices

The Web is increasingly being accessed by portable, multi-touch wireless devices. Despite the popularity of platform-specific (native) mobile apps, a recent study of smartphone usage shows that more people (81%) browse the Web than use native apps (68%) on their phone. Moreover, many popular native apps such as BBC depend on browser-like components (e.g., Webview) for their functionality. The popularity and prevalence of web browsers on modern mobile phones warrants characterizing existing and emerging threats to mobile web browsing, and building solutions for the same. Although a range of studies have focused on the security of native apps on mobile devices, efforts in characterizing the security of web transactions originating at mobile browsers are limited. This dissertation presents three main contributions: First, we show that porting browsers to mobile platforms leads to new vulnerabilities previously not observed in desktop browsers. The solutions to these vulnerabilities require careful balancing between usability and security and might not always be equivalent to those in desktop browsers. Second, we empirically demonstrate that the combination of reduced screen space and an independent selection of security indicators not only make it difficult for experts to determine the security standing of mobile browsers, but actually make mobile browsing more dangerous for average users as they provide a false sense of security. Finally, we experimentally demonstrate the need for mobile specific techniques to detect malicious webpages. We then design and implement kAYO, the first mobile specific static tool to detect malicious webpages in real-time.Ph.D

Correlation of affiliate performance against web evaluation metrics

Affiliate advertising is changing the way that people do business online. Retailers are now offering incentives to third-party publishers for advertising goods and services on their behalf in order to capture more of the market. Online advertising spending has already over taken that of traditional advertising in all other channels in the UK and is slated to do so worldwide as well [1]. In this highly competitive industry, the livelihood of a publisher is intrinsically linked to their web site performance.Understanding the strengths and weaknesses of a web site is fundamental to improving its quality and performance. However, the definition of performance may vary between different business sectors or even different sites in the same sector. In the affiliate advertising industry, the measure of performance is generally linked to the fulfilment of advertising campaign goals, which often equates to the ability to generate revenue or brand awareness for the retailer.This thesis aims to explore the correlation of web site evaluation metrics to the business performance of a company within an affiliate advertising programme. In order to explore this correlation, an automated evaluation framework was built to examine a set of web sites from an active online advertising campaign. A purpose-built web crawler examined over 4,000 sites from the advertising campaign in approximately 260 hours gathering data to be used in the examination of URL similarity, URL relevance, search engine visibility, broken links, broken images and presence on a blacklist. The gathered data was used to calculate a score for each of the features which were then combined to create an overall HealthScore for each publishers. The evaluated metrics focus on the categories of domain and content analysis. From the performance data available, it was possible to calculate the business performance for the 234 active publishers using the number of sales and click-throughs they achieved.When the HealthScores and performance data were compared, the HealthScore was able to predict the publisher’s performance with 59% accuracy

Deteção de anomalias em modelos de publicidade Pay-Per-Click

Dissertação de mestrado em Engenharia InformáticaNowadays, online advertisement is one of the most effective and profitable marketing strategies. An example of strong growth in online advertisement is the Pay-Per-Click Advertising Model where all parties are benefited. Due to the number of stakeholders and the amount of money involved, it is inevitable to find efficient methods to analyse the validity of clicks on online advertising, specifically in Pay-Per-Click. The confidence of the advertiser is a crucial point to the success of this model. So it is necessary the distinction between the valid and the invalid clicks, made with the intention of generating charges, benefiting directly or indirectly with that action. Therefore, a state of the art about fraud detection techniques in Pay-Per-Click will be presented, as well as the main techniques used to deceive this advertising model. Other related matters were subject of study, such as the relevant data to collect for an accurate analysis of data flow at the servers. It was performed a comparative analysis of different approaches of anomaly detection in order to identify the most suitable for the problem at hand. Using this subarea of Data Mining, very satisfactory results have been achieved, thus concluding that anomaly detection can give a major contribution to the resolution of Pay-Per-Click fraud.Os anúncios online são atualmente uma das estratégias de marketing mais rentáveis e eficientes. Um exemplo de forte crescimento nesta área é o modelo de publicidade Pay-Per-Click, onde todos os intervenientes são beneficiados. Devido ao número de intervenientes e à quantidade de dinheiro envolvido, torna-se inevitável encontrar métodos eficientes para analisar a validade dos cliques efetuados em publicidade online, mais concretamente em sistemas Pay-Per-Click. A confiança do anunciante é um fator crucial para o sucesso deste modelo. Assim, é necessário distinguir os cliques válidos dos inválidos, feitos com a intenção de gerar um débito, beneficiando direta ou indiretamente com essa ação. Deste modo, será apresentado um estado da arte sobre técnicas de deteção de fraude em Pay-Per-Click, assim como as principais técnicas utilizadas para defraudar esse tipo de modelo. Outros assuntos relacionados foram também objeto de estudo, tal como os dados necessários para uma análise precisa do fluxo de dados nos servidores. Foi efetuado uma análise comparativa de diferentes abordagens de deteção de anomalias a fim de identificar quais as mais adequadas para o problema em questão. Com recurso a esta subárea de Data Mining foram alcançados resultados bastantes satisfatórios, concluindo-se assim que a deteção de anomalias pode dar um contributo fundamental para a resolução de fraude em Pay-Per-Click

Англійська мова для студентів, які вивчають медіа-комунікації

The text-book offers authentic texts on media communication and tasks based on them for students to gain professional knowledge and skills to be competitive in modern English-speaking media sphere. The text-book is recommended for Masters in Media Communication and Masters in Telecommunication Systems and Networks and Video, Audio and Cinematographic Equipment.Навчальний посібник є системною добіркою автентичних текстів та завдань до них для набуття студентами професійних знань і комунікативних навичок в англомовній медіа-сфері. Рекомендовано для студентів, які навчаються в магістратурі зі спеціальності "Медіа-комунікації", а також спеціальностей "Телекомунікаційні системи й мережі" та "Аудіо-, відео- й кінотехніка"

Combating Attacks and Abuse in Large Online Communities

Internet users today are connected more widely and ubiquitously than ever before. As a result, various online communities are formed, ranging from online social networks (Facebook, Twitter), to mobile communities (Foursquare, Waze), to content/interests based networks (Wikipedia, Yelp, Quora). While users are benefiting from the ease of access to information and social interactions, there is a growing concern for users' security and privacy against various attacks such as spam, phishing, malware infection and identity theft. Combating attacks and abuse in online communities is challenging. First, today’s online communities are increasingly dependent on users and user-generated content. Securing online systems demands a deep understanding of the complex and often unpredictable human behaviors. Second, online communities can easily have millions or even billions of users, which requires the corresponding security mechanisms to be highly scalable. Finally, cybercriminals are constantly evolving to launch new types of attacks. This further demands high robustness of security defenses. In this thesis, we take concrete steps towards measuring, understanding, and defending against attacks and abuse in online communities. We begin with a series of empirical measurements to understand user behaviors in different online services and the uniquesecurity and privacy challenges that users are facing with. This effort covers a broad set of popular online services including social networks for question and answering (Quora), anonymous social networks (Whisper), and crowdsourced mobile communities (Waze). Despite the differences of specific online communities, our study provides a first look at their user activity patterns based on empirical data, and reveals the need for reliable mechanisms to curate user content, protect privacy, and defend against emerging attacks. Next, we turn our attention to attacks targeting online communities, with focus on spam campaigns. While traditional spam is mostly generated by automated software, attackers today start to introduce "human intelligence" to implement attacks. This is maliciouscrowdsourcing (or crowdturfing) where a large group of real-users are organized to carry out malicious campaigns, such as writing fake reviews or spreading rumors on social media. Using collective human efforts, attackers can easily bypass many existing defenses (e.g.,CAPTCHA). To understand the ecosystem of crowdturfing, we first use measurements to examine their detailed campaign organization, workers and revenue. Based on insights from empirical data, we develop effective machine learning classifiers to detect crowdturfingactivities. In the meantime, considering the adversarial nature of crowdturfing, we also build practical adversarial models to simulate how attackers can evade or disrupt machine learning based defenses. To aid in this effort, we next explore using user behavior models to detect a wider range of attacks. Instead of making assumptions about attacker behavior, our idea is to model normal user behaviors and capture (malicious) behaviors that are deviated from norm. In this way, we can detect previously unknown attacks. Our behavior model is based on detailed clickstream data, which are sequences of click events generated by users when using the service. We build a similarity graph where each user is a node and the edges are weightedby clickstream similarity. By partitioning this graph, we obtain "clusters" of users with similar behaviors. We then use a small set of known good users to "color" these clusters to differentiate the malicious ones. This technique has been adopted by real-world social networks (Renren and LinkedIn), and already detected unexpected attacks. Finally, we extend clickstream model to understanding more-grained behaviors of attackers (and real users), and tracking how user behavior changes over time. In summary, this thesis illustrates a data-driven approach to understanding and defending against attacks and abuse in online communities. Our measurements have revealed new insights about how attackers are evolving to bypass existing security defenses today. Inaddition, our data-driven systems provide new solutions for online services to gain a deep understanding of their users, and defend them from emerging attacks and abuse